VDB

CVE-2018-11385

CVE-2018-11385 PUBLISHED

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.

EPSS 0.90% · 76.1th percentile

Risk Scores

EPSS Score
0.90%
76.1th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSsymfony0, 3.4.6+dfsg-1, *
Ubuntu:16.04:LTSsymfony2.7.1+dfsg-1, 2.7.9+dfsg-1, 2.7.10-0ubuntu2

Exploit Intelligence

Timeline

  • Jun 13, 2018 CVE Published
  • Mar 12, 2019 CVE Updated
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Feb 28, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score
  • Jan 8, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›